SOUND4 Impact/Pulse/First Directory Traversal File Write Vulnerability (ZSL-2022-5730/CVE-2023-53962)

Key Information Advisory ID: ZSL-2022-5730 Vulnerability Type: Directory Traversal File Write Impact: - Exposure of System Information - Exposure of Sensitive Information Risk: 5/5 Release Date: 14.12.2022 Summary: Input passed to the 'filename' POST parameter in the improperly validated 'upgrade.php' script allows arbitrary file writing to any location. Vendor: SOUND4 Ltd. - https://www.sound4.com Affected Version: - FM/HD Radio Processing: Impact/Pulse/First (Version 2: 1.1/2.15), Impact/Pulse/First (Version 1: 2.1/1.69), Impact/Pulse Eco 1.16 - Voice Processing: BigVoice4 1.2, BigVoice2 1.30 - Web-Audio Streaming: Stream 1.1/2.4.29 - Watermarking: WM2 (Kantar Media) 1.11 Tested On: - Apache/2.4.25 (Unix) - OpenSSL/1.0.2k - PHP/7.1.1 - GNU/Linux 5.10.43 (armv7l) - GNU/Linux 4.9.228 (armv7l) Vendor Status: - [26.09.2022] Vulnerability discovered - [30.09.2022] Vendor contacted - [13.12.2022] No response from vendor - [14.12.2022] Public security advisory released PoC: sound4_traversal.txt Credits: Vulnerability discovered by Gjoko Krstic - gjoko@zeroscience.mk References: - [1]: https://packetstormsecurity.com/files/170257/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Directory-Traversal-File-Write.html - [2]: https://exchange.xforce.ibmcloud.com/vulnerabilities/247919 - [3]: https://www.exploit-db.com/exploits/51172 - [4]: https://www.cve.org/CVERecord?id=CVE-2023-53962 - [5]: https://www.vulncheck.com/advisories/sound-impactfirstpulseecox-unauthenticated-directory-traversal-file-write Changelog: - [14.12.2022]: Initial release - [28.12.2022]: Added reference [1] - [20.04.2023]: Added references [2] and [3] - [24.12.2025]: Added references [4] and [5]

Goal Reached Thanks to every supporter — we hit 100%!

SOUND4 Impact/Pulse/First Directory Traversal File Write Vulnerability (ZSL-2022-5730/CVE-2023-53962)